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ABSTRACT 


As documented by a two-volume report, criteria to deter- 
mine the probability of aerospace structural failure were sta- 
tistically established according to the Quantitative Structural 
Design Criteria by Statistical Methods, the QSDC procedure. 

Since an Application Guide is needed to use the QSDC procedure, 
most of the study was directed to the development of this guide. 
Most of the considerations followed in the development of the 
Applications Guide and the Guide itself are covered in Volume 
II; the others are reported in Volume I. 
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1 . 


INTRODUCTION 


The study to establish statistically based criteria for 
the probability of failure was directed to the development of 
the proposed structural design criteria method, the QSDC Pro- 
cedure, as a means to establish the space shuttle structural 
design criteria. The proposed method, defined in an earlier 
report by the author, "Quantitative Structural Design Criteria 
by Statistical Methods" (AFFDL TR-67-107, Reference 1) , was 
developed as a criteria method for aircraft systems. .However, 
the concepts on which the QSDC Procedure are based are not re- 
stricted to aircraft systems but are univeral in scope and, 
therefore, should be equally applicable to the space shuttle. 

These basic concepts of the QSDC Procedure have been outlined 
in the "Summary of the QSDC Procedure for Space Shuttle Appli- 
cations" (TI-425-71-4, Reference 2) and are briefly repeated 
here : 

The QSDC Procedure is a failure-prevention criteria method 
in which failures may be of two types: understrength and over- 

load. Each type of failure is prevented by designing for a 
specific design condition. Understrength failures are prevented 
by designing for the Limit Condition and overload failures are 
prevented by designing for the Omega Condition. To insure that 
the structure is properly designed for the Limit and Omega Con- 
ditions, the loads that correspond to these conditions are multi- 
plied by a design factor. This factor is necessary to prevent 
failures that would occur if the structure were designed to sustain 
the loads at the Limit and Omega Conditions without consideration 
of the scatter in strength of the design. The design and test 
factor of safety (TFS) of the QSDC Procedure is defined in terms 
of the scatter in strength of the design and, therefore, fulfills 
the above purpose; whereas the discrete 1.5 factor of safety 
of the Present System cannot account for the strength scatter. 

Reality dictates that failures cannot be absolutely pre- 
vented, and therefore, the definition of the prevention of fail- 
ure must be tempered to reflect this. Such a tempering might be 
embodied by considering the probability of failure instead of 
considering the failure as a deterministic event. In the QSDC 
Procedure this is considered. Thus, the structural design cri- 
teria (the definition of the Limit and Omega conditions and the 
determination of the design factors) have been placed on the 
basis of a probability of failure analysis. As a result, the 
QSDC Procedure can specify criteria values that are determinis- 
tic in value yet are statistically based (on this probability 
of failure analysis). 

The QSDC Procedure is, therefore, a method by which struc- 
tural design criteria can be determined on the basis of the con- 
sideration of failure. What remains as the objective of this 
study is to relate this procedure to the design problems of the 
space shuttle and to clarify the implementation of the procedure 
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in solving these design problems. The design problems that are 
particularly those of the space shuttle and therefore needing 
attention are: 

1) Thermal effects due to exit and re-entry 

2) Utilization of advanced materials and structural 
concepts 

These considerations are discussed in Section 2, The Study 
Effort. Other topics relating to the utilization of the QSDC 
Procedure in general that were not discussed in Volume II are 
presented in Section 3. The conclusions reached as a result of 
the study effort are discussed in Section 4. Recommendations 
for future effort in the application of the QSDC Procedure to 
the space shuttle structural design criteria, as well as to the 
development of the QSDC Procedure itself, are presented in 
Section 5. 
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2 . 


STUDY EFFORT 


2 . 1 Scope 

The effort on the study to establish statistically based 
criteria for determining the probability of structural failure 
was divided into four phases and subdivided into eight study 
tasks. The four phases were: 

1) Summary of Criteria Concepts 

2) Review of Previous Programs 

3) Applications to Space Shuttle 

4) Final Report 

Phase 4, the final report, of which this report is the end product, 
was not considered as a study phase. The following eight study 
tasks, therefore, apply only to the first three phases of the study 

1) Prepare Summary Report 

2) Review Previous Criteria 

3) Define Relation to Mission Requirements 

4) Evaluate Program Success 

5) Compare Space Shuttle Mission Requirements 

6) Determine Changes in Criteria for Space Shuttle Criteria 

7) Develop Examples 

8) Prepare Application Guide 

Essentially, the problem could be viewed as the definition 
of structural design criteria by a statistical analysis of the 
probability of failure. The means to solve this problem had 
been defined in Reference 1 as the QSDC Procedure. However, 
the QSDC Procedure needed to be. developed before it could be 
utilized in the criteria definition for the space shuttle. This 
development has been included in the content of the Applications 
Guide (Task 8) . 

2 . 2 APPROACH 


The definition of structural design criteria by a statisti- 
cal analysis of the probability of failure has been outlined in 
Reference 1 as the QSDC Procedure. In the same report, an eval- 
uation of other probability of failure (reliability) methods was 
made. The result was that they do not provide discrete design 
criteria and, therefore, are not practical design criteria methods. 
On the other hand, the discrete factor of safety methods which 
do not consider statistical variations, such as the Present (1.5 
factor of safety) System, do not reflect, the design requirements 
for the actual situation of the structure. The study concluded 
that a hybrid design criteria method was needed. As a result, 
the QSDC Procedure was developed as a criteria method that 
establishes criteria on a statistical (probability of failure) 
analysis that are deterministic in their utilization. 
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The QSDC Procedure, as developed in the content of Reference 
1, was based on the evaluation of a present aircraft system, the 
F-100 century fighters. As a system that is already developed 
and in use, the F-100 reflects a utilization of the QSDC Proce- 
dure that is greatly different from an application to a new, 
undefined design. Essentially, the difference is that in the 
case of the F-100, the structure is known and the spectrum of 
operational conditions is known whereas in the case of the new 
design, neither the structure nor the operational condition spectra 
are known with a great degree of certainty. As a result, there 
has been a shift of emphasis in the utilization of the QSDC Proce- 
dure: from the knowledge of the structure (and therefore the 

strength scatter) and the operational condition spectra (and 
hence the design condition levels of Limit and Omega Conditions) 
as in the F-100 study to the estimation of the strength scatter 
and design conditions in the space shuttle study. This new em- 
phasis has been included in the Applications Guide. 

After the QSDC Procedure was developed to handle the above 
problems of a new design, it was applied to the Space Shuttle 
and example problems were developed to illustrate the use of 
the QSDC Procedure in this "new design" context. These were also 
included in the Applications Guide. 

2.3 LIMITATIONS 


The scope of this study was limited due to the time avail- 
able. With respect to time, the criteria considered relative 
to the probability of failure were restricted to the structural 
design criteria and, in particular, the definition of the design 
conditions and the appropriate design factors. From the defini- 
tion of failure as the catastrophic failure of the structure, no 
consideration of a yield strength requirement was made in this 
study. However, a discussion of potential future considerations 
for yield strength requirements can be found in Section 3, Related 
Topics . 

2.4 DISCUSSION 

As mentioned in the introduction, the QSDC Procedure was 
developed in Reference 1 relative to the static strength situ- 
ation of a developed aircraft system, the F-100 series fighters. 

In this study, the utilization of the QSDC Procedure as a design 
criteria method for a new, unprecedented structure is contem- 
plated. As a result, the QSDC Procedure must be adapted to the 
new frame of reference. 

The basic concepts of the QSDC Procedure are not altered; 
rather, the scope of their application is expanded. In this 
study, an application of the QSDC Procedure to the development 
of structural design criteria for the space shuttle design 
problems is presented. In the following sections, the design 
problems and an approach to these design problems are outlined. 
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2 . 4 . 1 . 


Thermal Effects 


The first of the design problems not previously encoun- 
tered by the QSDC Procedure are the thermal effects induced by 
the aerodynamic heating of the vehicle. Aerodynamic heating 
occurs in both the ascent and re-entry phases of the space shut- 
tle mission and produces two thermal effects: elevated tempera- 

tures and temperature gradients. The QSDC Procedure, as a design 
criteria method, is required to specify in some manner design 
criteria that will effectively consider the effects of the aero- 
dynamic heating in the design of the structure. 

The general procedure of the QSDC is to define the 
operational condition that produces the critical loading on the 
structure, specify design levels (Limit and Omega) for that con- 
dition, and then design the structure for "no" failure at Limit 
and "most" survive Omega. In the case of aerodynamic heating, 
the thermal effects of temperatures and temperature gradients 
are the environmental conditions, but they do not fall in the cat- 
egory of operational conditions. (Essentially, they do not satis- 
fy the requirement of defining an interface between the structural 
and non- structural organizations that would define corrective 
action.) Instead, the thermal effects can be viewed as derived 
conditions; that is, they are produced by the combination of a 
set of operational conditions. The thermal effects (TE) are a 
function of the general trajectory parameters, velocity (V) or 
mach number (M) , altitude (h) , vehicle orientation (ot), and time 
(t) ; i.e. , 

T.E. = f (M, h, a, t) 

As such, the thermal effects can be effectively controlled by 
controlling these trajectory parameters. The trajectory param- 
eters can, therefore, be defined as the operational conditions, 
for they can fulfill the function of a meaningful interface 
between the non-structural control system and the structural 
system. As interface conditions, exceedances of specified de- 
sign values (Limit and Omega Conditions) can be detected and 
corrective action taken. Instrumentation is required to detect 
any such exceedances and, therefore, should be considered in the 
determination of operational conditions. The trajectory param- 
eters, M, h, a, t, are typically instrumented variables and 
therefore are easily defined as operational conditions. 

The next step in the general procedure requires that the 
QSDC Procedure define the operational condition spectra and 
specify from it two design conditions (Limit and Omega) . In 
the case being considered, the spectra of the trajectory par- 
ameters can be described as the combination of the individual 
trajectory parameters in a base-line trajectory described by 
the set (M, h, a, t) plus the dispersions of the individual tra- 
jectory parameters about the baseline values. That is, the spec- 
trum can be defined by the set of points defined by: 
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(M + AM, h + Ah, a + Aa , t + At) 

where AM, Ah, Aa , At are controllable by the non- structural 
systems. The magnitudes of AM, Ah, Aa, and At that can be 
tolerated will define the Limit and Omega Conditions. Refer 
to Volume II for the definition of Limit and Omega Conditions 
in the QSDC Procedure. 

The last general step of the QSDC Procedure is the design 
of the structure for the design conditions. The considerations 
to be made in the structural design that result from the effects 
of aerodynamic heating are the decrease in the strength of 
materials with elevated temperatures, thermal stresses resulting 
from temperature gradients, and creep due to repeated load and 
temperature combinations. It is recommended that these consider- 
ations be handled in the following manner: 

The reduction in mean strength is interpreted as an increase 
in the strength scatter (y s ) of the structure in the QSDC Procedure. 
The design of the structure therefore will require slightly larger 
design factors than the room temperature case. The design factor 
is applied to the load and matched with the allowable stress at 
elevated temperatures by adjusting the required area of the com- 
ponent. Usually, this will result in an increase in the area 
because of the larger design factor and lower allowable stress 
level. The structure is sized so that the probability of failure 
of the structure at the elevated temperature will be no greater 
than intended. Because the temperatures are the result of the 
trajectory, the loads that are considered in conjunction with the 
strength reduced by the temperature levels (which are used to de- 
fine the reliability of the structure) may be more narrowly defined 
than the same combinations in the level flight phase. This would 
result in more realistic reliability calculations. However, the 
variation in the temperature- load combinations should be considered 
at all the points on the trajectory. 

The second thermal effect to be considered is thermal stresses 
that result from temperature gradients. The QSDC Procedure can 
account for this effect in the load-condition context where the 
load is the mechanical stress induced by the thermal gradient 
stresses and the conditions are, again, the trajectory conditions. 
Similar to the loss of strength due to elevated temperatures, 
the mechanical loads that occur due to thermal stresses may be 
a narrowly defined distribution due to the trajectory dependancy; 
however, the variations in thermal stress and mechanical load 
at all points on the trajectory should be considered. 

The third thermal effect to be considered is the effect 
of creep. The time dependent problem of creep would include 
detrimental deformations, creep cracking, and creep rupture. 

Of the three, creep rupture will contribute directly to failure 
and should, therefore, be given consideration in the residual 
strength function where elevated temperature environments are 
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encountered. Creep rupture may occur as the result of either 
an excessive load-time environment on the structure for the 
temperature encountered or a normal load-time environment on 
a structure weakened by creep cracking. If these mechanisms 
can be analyzed, they should be included in the probability of 
failure analysis. The problem of detrimental deformation is 
not included in the probability of failure analysis for the same 
reason that yield is not included (see Section 3). Essentially, 
detrimental deformations are correctable non-catastrophic fail- 
ures, and can be accounted for by other (economic) considerations. 

2.4.2 Advanced Materials and Structural Concepts 


Advanced materials and structural concepts are parti- 
cularly adaptable to the QSDC Procedure because the strength 
scatter (Y s ) of the structure depends on the Ys i n both the 
material and the structural concept. After appropriate test- 
ing has defined the y s in an advanced material and its struc- 
tural configuration, the QSDC Procedure can utilize the material 
in a design much faster than is now possible. Where the Present 
System requires years of experience to determine the y s of an 
advanced material with a high level of confidence before it will 
utilize such a material for an aircraft structure, the QSDC Pro- 
cedure can readily do so since it can include materials with 
a large y s . 


Although larger factors of safety will result from materials 
with larger y^ , such factors may be more than offset, especially 
when high- temperature strength is gained. For example, consider 
a conventional material A and an advanced material B. Material 
A has an y s of 0.04 at 70° F and an F+ u of 72 ksi at 70° F which 
is reduced 50 percent (36 ksi) at 600® F. Since y s = o/y, a 
may be kept constant as y decreases (represented by an F tu decrease) 
with temperature increase so that y s equals 0.08 at 600°F. Conse- 
quently, the LTFS for material A at 70° and 600° F is 1.25 and 
1.62, respectively. Material B has an 0.08 y s at 70°F and an F+ u 
of 72 ksi at 70°F which is reduced only 16.6 percent (to 60 ksi) 
at 600°F. At the elevated temperature, material B has a 0.096 
Ys- 


Standard design methods may be used to compare the two 
materials, i.e., the area (A) for a given load (P) . First, a 
design load (Pq) is specified by multiplying the given load P 
by a design LTFS: 

P D = P-LTFS 

Second, the structure is sized by matching Pp to A: 

P D/ A = °all 


such that the allowable stress (a all ) is equalled. Thus, for 
material A, 
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A A =(LTFS A *P)/a allA = 1.62P/36 = 0.045P 
and for material B, 

A B =(LTFS B *P)/a allB = 1.82P/60 = 0.0304P 


The factor (LTFS/o^j) thus defines the area/load ratio of the 
material. By comparing the required areas for the two materials 
and the material densities, the required weights of the two ma- 
terials can also be compared and weight tradeoffs may be made. 

The required area for material B is 33 percent less than that 
for material A, even though material B has a greater LTFS. As- 
suming that the densities of the two materials are equivalent, 
material B would be lighter than material A. Consequently, ma- 
terial B has the advantage since its larger F tu at the required 
temperature more than compensates for its higher LTFS; moreover, 
since the larger LTFS is based on a constant reliability level 
(see Figure 6, Volume II), the use of material B does not jeopar- 
dize the safety of the vehicle. 

2.5 Redundant Structure 


As the space shuttle structure, both booster and orbiter, is 
a highly redundant structure, the contribution that redundant struc- 
ture makes to the probability of failure of the overall structure 
should be considered. Before this consideration can be made, how- 
ever, the definition of the failure of redundant structure must be 
determined. This is discussed in Section 2.5.1. Once failure is 
defined, the modes of failure may be investigated, and finally 
the probability of that failure may be determined. Having thus 
established the probability of failure of redundant structure 
(Section 2.5.2), the effect of variations in margin of safety, 
tests, periodic inspections, fatigue measurement techniques, and 
replacement-refurbishment procedures on the probability of failure, 
and, hence, the reliability of the structure are discussed (Section 
2.5.3). 

2.5.1 Failure in Redundant Structure 


Failure, in the context of this study, is the catas- 
trophic rupture or collapse of the structure. This definition 
applies to both redundant and non-redundant structure in the 
sense that the end result--the loss of the overall structure and 
the inability to complete the mission-- is the same for both 
types of structure. However, failure in redundant and non- 
redundant structures are differentiated by their mechanisms. 
Failure in non-redundant structure is typically a single dis- 
crete event (the parting of metal), whereas failure is redundant 
structure is the result of the accumulated loss of redundancy 
through fatigue cracking and is culminated in the static fail- 
ure of the weaker, remaining structure. In either case, the 
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final failure results from a load which exceeds the available 
strength of the structure. It is on this point, the load exceeding 
the available strength, that this study focuses its attention. 

The externally applied load is assumed as known, at 
least in terms of a load spectrum with a probability distribu- 
tion assigned to it. However, difficulty is encountered in the 
distribution of this external load among the elements of the re- 
dundant structure (to be discussed in Section 2.5.2). The strength 
of the redundant structure presents a similar difficulty. The 
determination of the probability of failure of a redundant structure 
as a function of the fatigue loading is a difficult, if not impos- 
sible, task. 

2.5.2 Probability of Failure 

The determination of the probability of failure of the 
redundant structure in the scope of this analysis requires the 
determination of the probability of exceeding a given load and 
the determination of the probability of exceeding the strength 
of the structure with that particular load. Unfortunately, 
neither of these probabilities is easily determined. 

As previously mentioned, the mode of failure in redun- 
dant structure is the accumulated loss of redundancy and strength 
due to fatigue cracking of the structure. The analysis of the 
probability of failure should, therefore, be modeled after the 
mode of failure. That is, the probability of failure of each 
redundant element must be analyzed and combined in the determina- 
tion of the probability of failure of redundant structure. Be- 
fore such a modeling can occur, the following assumptions must 
be recognized and considered in the analysis: 

1) Separate, non- redundant elements or load 
paths can be defined within the redundant 
structure . 

2) The distribution of the externally applied 
loads among the elements of the redundant 
structure can be calculated. 

3) The redistribution of the externally applied 
loads with each element failure can be 
calculated. 

4) The strength distribution of each element as 
a function of the loading history can also 
be calculated. 

These assumptions are necessary for an element-by-element anal- 
ysis of the probability of failure of a redundant structure. 
Obviously, if the redundant structure were considered as a black 
box, the above assumptions are not necessary. However, the 
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analytical determination of the probability of failure of the 
redundant structure becomes an impossible task, and an empirical 
study to determine the probable strength must be relied upon. 

Based on the previous assumptions, the probability of 
failure of redundant structure (Pp[S]) can be described by the 
following model, where the failure of a redundant structure re- 
quires the failure of all of its elements (Pp(ap) i=l, ...n) 
where n equals the number of non-redundant elements: 

P F [S] = p f C ai D *Pp ^/a^) *Pp Ca 3 /a 1 a 2 ) • ... * p p (a n /ap . . . a n _ p) 

The previous assumptions are necessary so that the terms on the 
right-hand side of the equation may be defined. That is, the 
probability of failure of any given element (ap) depends on the 
ability to define the probability of exceeding a given load and 
the probability of exceeding the strength of that element xvith 
the given load. Obviously, neither probability can be determined 
without making the previous assumptions. The assumptions do 
not imply an exact knowledge of the load and strength in the ele- 
ments; rather, they imply that the load and strength can be de- 
termined within the limits of a range of strength or load with 
probabilities assigned. Finally, the probability of failure 
of the element a^ can be described by: 

Pp( a l) = Pp (Lp) * P (s<_ Lp) 

where Pp(Lp) is the probability of exceeding a given load level 
L in element ap and P(s< Lp) is the probability of the strength 
of element ap being less than or equal to L, the given load level. 

The second right-hand term Pp (a 2 /ap) and succeeding 
terms through Pp (a^/ap . . .a n _p) represent the failure of the 
second through the (n-l)th redundancy on the condition of the 
failure of the first and each successive redundancy. This con- 
ditional dependency must be considered since the probability of 
failure of element a 2 on the condition of the failure of ap 
(Pp(a 2 /ap)} will differ from the probability of failure of a 2 
(Pp(a 2 )) where the change is due primarily to the new load dis- 
tribution. Reference 3 has demonstrated this dependency. 

To demonstrate the analysis model proposed, consider 
the following example: 

A variable mass M is suspended from a fixed surface 
by three rods, numbered 1, 2, and 3, as shown in Figure 1. Con- 
sidering loads in the x direction only, this describes a doubly 
redundant system. The function of this system is the support 
of the mass and, therefore, failure is described by the inability 
to suspend the mass any longer. Assuming that the mass M is 
varied cyclically between 0 and Mp , the supporting rods 1, 2, 
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and 3 are subjected to fatigue loading. The probability of 
failure of the structure may be described by the model as: 

p f[S] = p F(a) -P F (b/a) -PpCc/a.b) 

where the six different failure paths are described by the 
following rod failure orders: 


a b 

1 2 

1 3 

2 1 

2 3 

3 1 

3 2 

The structure will fail according 
most likely according to the path 
computation of the P F (a), Pp(b/a), 
ing to the previous equation: 


c 
3 
2 
3 
1 
2 
1 

to any one of these paths, and 
with the highest P p [S]. The 
and Pp (c/a ,b) will be accord- 


p F (a)= (Lp) • P (s<. L p ) 


and subject to 


the same assumptions. 



Figure 1. Model of Redundant Structure 


It must be observed that these assumptions are rather 
gross all-encompassing and, in certain circumstances, invalid. 

t might be said that the problem has been ''assumed out of exis- 
tence by these assumptions. However, it can also be said that 
the assumptions delineate the real problems of analyzing the 
probability of failure of a redundant structure. 


i j Essentially, the real problem is being able to describe 
the load and strength of the elements in a redundant configuration 
and to derive from this information the probability of failure of 
the configuration. It should be recognized that the load and 
strength of the redundant components is not always available and 
that the analysis becomes further complicated by the probable lo- 
cation of the strength and load in the possible spectrum of 
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strengths and loads. Reference 3 has considered this same ex- 
ample problem (a simple structural configuration) where the load 
and strength are assumed as known, and has made similar assumptions. 
The mathematics required to solve even this simple problem become 
extremely complex, so much so that the application of this analysis 
to actual structure becomes quite implausible. 

2.5.3 Parametric Effects 


The effect of the following parameters on the relia- 
bility (probability of failure) of redundant structure is dis- 
cussed . 

2. 5. 3.1 Margin of Safety 

The margin of safety in the QSDC Procedure is defined 
in the same manner as the Present System where the margin of 
safety is the ratio of the allowable stress to the actual stress 
at the design condition minus one. 

The margin of safety (MS) of the Present System can 
be described as follows: The design load level (Ultimate) is 

determined by the loads analysis, which is then multiplied by 
the factor of safety (FS) . The vehicle is, then, sized by de- 
termining the proper area (Ap) to produce the allowable stress 
(Fall) given the structure and the factored load. (The FS may 
be a composite of several FS, i.e., fitting and fatigue FS's.) 
thus , 

P D = P U ‘FS 

where Ap is chosen such that 


P d /Ad = F all 


A D = (A n /(P D /A n ) = F all } 

Assuming that the structure sees an ultimate load, the actual 
stress in the structure would equal P u /Ap or 

Fact = F u /Ap . 

The margin of safety can then be expressed in terms of the 
factor of safety as: 

MS = -1 

Fact 

V FS a d, 

= ^ 

= FS - 1 
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As the relationships are similar for the OSDC Procedure, we can 
express the margin of safety for the Limit and Omega design points 
as : 

MS t = LTFS - 1 

and 

MS n = OTPS - 1 

As the LTFS and the OTFS are chosen on the basis of 
reliability, the relationship of the margin of safety to the sys- 
tem reliability becomes obvious. Similarly, the relationship of 
the margin of safety to the probability of failure is also 
obvious . 

2. 5. 3. 2 Tests 


The type and number of tests conducted on the structure 
have been related to the structural reliability of the design in 
the designation of the design criteria for the static and fatigue 
tests. As such, these relations were presented in Sections 2.2.4 
and 2.3.4 of Volume II. The QSDC Procedure places the emphasis 
of structural verification on the loading test of an actual 
full-scale structure rather than on non-destructive inspection 
techniques. 

2 . 5 . 3 . 3 Periodic Inspections 

The periodic inspection of the structure by both visual 
and non-destructive methods will detect flaws that could produce 
failure. However, the actual detection of flaws is subjective 
and strongly dependent on the inspector's interpretation of the 
available data. As such, it is not necessarily amenable to the 
determination of the reliability remaining in the structure at 
any time during the lifetime of the vehicle because cracks can be 
overlooked. Rather, the purpose of periodic inspection has been 
the detection of cracks which, if left unattended, would fail 
the structure before the next inspection. Essentially the period 
of the inspection becomes the important consideration in determining 
the required strength for a given component as presented by B. 0. 
Lundberg in several of his papers (References 4, 5, and 6). 

2. 5. 3. 4 Fatigue Measurement Techniques 

The application of fatigue measurement techniques to 
the problem of redundant structure would require that the fail- 
ure process be separated out and analyzed by a cumulative damage 
theory. This would be consistent with Lundberg's "critical num- 
ber of parts" criterion. Alternatively, the fail-safe load 
criterion would not analyze the part-by-part failure of the 
redundant structure but would associate a fatigue damage index 
with the fail-safe load level, where degradation of the strength 
to the fail-safe load level would equal an index of 1 or 1001 of 
allowable fatigue damage. The latter method is discussed in 
Volume II, Section 2.3. 
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2 . 5 . 3 . 5 Replacement -Refurbishment Procedures 

When used in conjunction with periodic inspections, re- 
placement* of fatigue sensitive components effectively increases 
the reliability of the structure. Essentially the fatigue damage 
in the component is reduced to zero with the replacement and 
possibly reduced to some portion of the fatigue damage by re- 
furbishment. For example, the drilling and plugging of a cracked 
honeycomb panel only eliminates the critical damage in the re- 
paired part of the panel. Damage may have been incurred in other 
parts of the panel and may have gone undetected; for instance, 
microscopic cracks which could quickly propagate to failure at 
another section of the panel. Therefore, the past history of 
loading in the rest of the panel cannot be ignored in the assess- 
ment of the fatigue damage index for the repaired panel (the 
crack initiation period was completed during the previous load- 
ing and the crack propagation phase may be all that remains be- 
fore structural failure). The ratio of the time of crack initia- 
tion in the panel to the panel lifetime (initiation + propagation) 
is dependent on the configuration of the panel and the crack 
orientation. The fatigue damage index of a repaired panel may 
then be typified by the ratio of the propagation phase to the 
lifetime. Say 20% of the lifetime can be attributed to crack 
propagation, then the fatigue damage index of the repaired 
panel would be 0.8. The length of time of these phases will also 
depend on the loading spectrum and the critical crack length, 
where the critical crack length could be defined by the fail- 
safe load level. 
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RELATED TOPICS 


3 . 


During the development of the QSDC procedure, the appli- 
cability of reliability, strength, scatter, and yield strength 
to the space shuttle was discussed. The discussion on relia- 
bility relates, in proper perspective, the output of the QSDC 
Procedure computer programs to the entire structural reliability 
goal and explains the rationale for using the design factor of 
safety of a single element for the entire structure. The dis- 
cussion on strength scatter points out some of the limitations 
on the data used to estimate the strength scatter values pro- 
posed in the Applications Guide and presents general guidelines 
for selecting the appropriate data. The discussion on yield 
strength indicated that the QSDC Procedure is readily adaptable 
to a yield strength requirement. However, the QSDC Procedure 
does not now include a yield strength criterion since it is 
based on a probability of failure analysis where failure is de- 
fined as catastrophic failure. 

3 . 1 Reliability 

3.1.1 Determination of the Structural Reliability 

The structural reliability considered in the QSDC Pro- 
cedure is the ability of the hardware, the flight article, to 
perform its function without failure for its design lifetime. 

The structure, as referred to here, is the framework of skin, 
stringers, frames for the fuselage, wing, tail, landing gear, 
etc., and is not to be confused with the system, consisting of 
the structure, the control (pilot, etc.) organization, and the 
non-structural systems, such as the propulsion system. The 
structure and system can be further differentiated by their 
functions, where the function of the structure is to sustain the 
loads imposed on it by the operational conditions, and the func- 
tion of the system is the completion of a specified mission. The 
corresponding reliabilities will also be different as a result 
of the difference in function: the reliability of the structure 
is a measure of its ability to sustain the loads without failure, 
and the reliability of the system is a measure of its ability to 
complete the mission successfully. The structural reliability 
is a factor in the system reliability, but is not equivalent to 
it. When combined with the control system reliability and the 
non-structural system reliabilities, the structural reliability 
should produce the system reliability. Whatever the relationship 
between the structural and system reliabilities is, it is to be 
considered in the analysis and in the setting of the structural 
reliability: be it LOW, STANDARD, or HIGH in value. However, 

the composition of the structural reliability is of concern. As 
the system reliability consists of the combination of sub-system 
reliabilities, so the structural reliability consists of the 
combination of the reliabilities of its components where the 
reliability of its components is described by the analysis of 
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the QSDC Procedure as discussed in Section 3.1.2. The relation 
of these component reliabilities to the structural reliability 
will be a function of how the components are combined to form 
the structure. Basically, the structural components can be com- 
bined to form a structure in two ways: as members of a determi- 

nant structure or as members of a redundant structure. Similar- 
ly, there are two ways to combine reliabilities (interpreted 
here by the complement of the reliability - the probability of 
failure) : as the combination of independent probabilities or 

as the combination of conditional probabilities. Thus, in the 
analysis of the reliability of a determinant structure, the com- 
bination of independent probabilities would be used. As an ex- 
ample of determinant structure, consider the major elements of 
an aircraft, namely the wing, tail, and fuselage. Obviously, 
if the wing, tail, or fuselage fails, the structure fails. By 
definition of determinant structure, the failure of one element 
means the failure of the combination of elements, i.e., the 
structure. 


In the case of redundant structure, the conditional 
probabilities should be used. An example of a redundant structure 
would be the wing box of an aircraft. The upper and lower surfaces 
consist of skin, stiffeners, and spar caps. In this case, the 
failure of the skin, stifferer, or spar cap does not necessarily 
mean the failure of the combination, i.e., the structure. There- 
fore, by definition, the structure is redundant. The reliability, 
or the probability of failure, of the combination is therefore 
conditional on the failure of some or all of the components. 

That is, there is a probability of failure of the combination of 
components, given that one component has already failed. Since 
the mathematics of independent and conditional probabilities 
have been worked out and can be found in any good text on sta- 
tistics, such as References 7, 8, and 9, they need not be dis- 
cussed here. 

3.1.2 Component Reliability 

The reliability computed by the QSDC Procedure is the 
result of a strength-exceeding load analysis. The strength to 
be used in the analysis is one of the basic strengths, such as 
tension, compression, bending, torsion, or their combinations, 
which may be related to an element or combination of elements 
(component) of the structure. The load used in the analysis is 
derived from an operational condition and must be referenced to 
the same element or component whose strength is being considered. 
Obviously, if the load exceeds the strength, the element or com- 
ponent fails, and the reliability is then zero. However, the 
analysis is not confined to the discrete single load and strength 
as in this example, but rather the analysis considers the dis- 
tribution of possible loads and strengths. Essentially, these 
distributions must be considered if the probability of failure 
of any structure is to be accurately computed. Although further 
details of the probability of failure analysis are given in 
Reference 1, the point remains that the reliability computed 
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by the computer program is the reliability of the component of 
the structure. The reliability of the component required for 
the total structural reliability should be determined by the 
relations discussed in Section 3.1.1. When such a determination 
cannot be made, the structural reliability should be met by each 
and every component. 

The analytical development of the probability of 
failure, or reliability, has not been considered as feasible 
because the reliability of the whole is not necessarily the sum 
of the reliabilities of its parts. If the definition of parts 
is exclusive of the interaction of the parts, this reasoning 
is valid. However, if the interaction of the parts is considered 
in the "summation," then the reliability may be computed by such 
a summation of parts. The interaction considered is the effect 
on the probability of failure of a component by the probability 
of failure of another component. 

Obviously, a structure can only fail once, and then 
only at the component that has been overloaded. It can be con- 
cluded, therefore, that the failure of the structure is the re- 
sult of the failure of a single principal component in its par- 
ticular failure mode for the given loading condition. If one 
component is much weaker than the rest, then the structure will 
fail as a result of that component failing before any other 
component fails. This is the rationale of the static test; that 
is, if a component of the structure is weak, it will fail in 
the test and the weakness will be disclosed. The structure should 
therefore reflect this situation in the analysis of the probability 
of failure; that is, the probability of failure of each component 
is dependent (or conditional) on the probability of survival of 
the other components, as well as on the probability of failure of 
its subcomponents (elements). This can be described mathemati- 
cally, as: 

P F [Ci] = P F [C 1 /P S [C 2 ], P S [C 3 ], ...P s [C n ] ] 

where 

PpfCp] represents the probability of failure of component 1. 

Pp[Cp/P s [C 2 ] ... P s [C n ]] represents the probability of 

failure of component 1 on the con- 
dition of the probability of survival 
of component 2, etc. 

n represents the total number of components. 


and 


Pp [Cp ] = PptCp/PstCn], P s [Ci2], ...P s [C lm ] ] 

where Cpp represents the subcomponent (element) 1 of com- 
ponent 1, etc. 
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m - represents the total number of subcomponents of component 
1 and combined: 

P F [Cil = P F tC 1 /P s [C 2 ] , ...P s [C n ], P s [C 12 ],...P s [C lm ] ] 

Repeating the same equation for all of the components n, the prob- 
ability of failure of the structure could be written as the com- 
bination of the n components 

Pf[c x ] = {P F [Ci], PfCc 2 ] , ... P F [C n ]} 

where { } denotes the function defining the combination of the 
components required by the structural configuration (see Section 
3.1.1). However, this rather massive and incomprehensible result 
can be greatly simplified by assuming that the failure of the 
structure is due to a single component lower in strength than the 
rest. Essentially, the probability of survival of the rest of the 
structures would be 1.0, and the results would be 

P F [S] = P F [ C il 

where is the understrength component. The rest of the com- 
ponents essentially drop out of the picture. Obviously, the 
designer must be able to determine which component is the weakest 
and design it with at least the desired structural reliability 
so that the entire structure will be reliable. This is the ra- 
tionale of the QSDC Procedure in choosing the strength scatter 
of the component with the largest strength scatter (the weakest 
component) as the strength scatter to be used for the entire 
structure. The LTFS and OTFS (see Volume II) derived from this 
scatter will be sufficient for the weakest component and conser- 
vative for the remainder of the structure for that loading condition 
and failure mode. 

The probability of failure, hence reliability, of the com- 
ponent will be the result of the several loads and their combi- 
nations that are induced on the component by the corresponding 
operational conditions. Mathematically, 

PptCll = p f[ c i/ e 01> e 02> • • • E 0kl 

where Eq^ represents the exceedance of the operational 

condition 1 . 

k represents the number of operational conditions 
that affect component 1. 

Obviously, all the conditions and their combinations must be 
investigated to define the critical loading conditions of the 
components. Present knowledge of these conditions and loads 
and their relations greatly simplify the analysis of the prob- 
ability of failure of the component. 
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Finally, the probability of failure analysis also 
depends on the accuracy of the load analysis. Consideration so 
far has been given to the strength of the component, but the 
estimation by the load analysis of the load that the component 
will experience relative to the operational condition will have 
an effect on the actual reliability of the component and hence 
on the reliability of the structure. Unfortunately, there is 
no way to account for this dependency in the design analysis 
except to be aware that the reliability indicated by the static 
test is conditional on the verification of the loads by the flight 
loads program. 

3 . 2 Additional Strength Requirement - Yield 

Yielding has played such an important role in the design 
of aircraft systems that it has been called the second strength 
requirement. Essentially, the yield strength requirement is a 
"no yield at the Limit Load" or a positive yield margin at Limit 
(Reference 10) . The yield strength requirement has been inter- 
preted as "no permanent set" (Reference 10) and "no detrimental 
permanent deformation" (Reference 11) with regard to the static 
test to the Limit Load. In these terms, the yield strength re- 
quirement has become a practical strength requirement. 

The yield strength requirement was not excluded from the 
QSDC Procedure intentionally: rather, it was excluded because 
it cannot be defined as failure in the same sense as the catas- 
trophic failure on which the QSDC Procedure is based. Yielding 
is purely an economic factor. Whenever it occurs the affected 
structure is replaced and if necessary the new structure is 
strengthened to avoid future occurrences. The important point 
here is that the structure still exists and can be restored. 

If a catastrophic failure occurs, the structure is destroyed, 
lives may be lost, and the mission is incomplete. Therefore, 
catastrophic failures must be avoided at all costs, whereas 
yielding may be tolerated at a reasonable cost. With this 
difference in mind, the yield strength requirement cannot be 
incorporated in the probability of failure analysis of the 
QSDC Procedure. However, since the yield strength requirement 
should not be ignored, it is suggested that a "probability of 
yield" analysis be carried out on the structure. 

A "probability of yield" analysis would consider the yield 
strength similarly as the QSDC Procedure considers the failing 
strength of the structure. For example, the yield strength 
will exhibit the same sort of distribution as the failing strength, 
and could be represented by a mean (y) and a standard deviation 
(a) . Yield strength scatter coefficients (Ysy) could therefore 
be computed from the mean and its standard deviation. These 
yield strength scatter coefficients could then be associated 
with appropriate yield factor-of- safety functions (similar 
to the LTFS of Section 2.2.3, Vol . II). Finally, these yield 
factor of safety functions can be referenced to the levels of 
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the "probability of yield" considered acceptable by the designer 
and program manager. 

The "probability of yield" that the designer and program 
manager will be forced to accept will be much higher than the 
probability of failure used in the OSDC Procedure. This is not 
inconsistent with the intention of either the Present System or 
the QSDC Procedure; rather, it is the reflection of it. Prelim- 
inary investigations have indicated that the yield strength 
scatter is larger than the failing strength scatter for most 
materials; the mean strength (y) is lower and the standard 
deviation (a) is the same or larger. Assuming that the LTFS 
relation (Figure 6, Volume II) is used; the larger strength 
scatter would require a larger factor of safety than specified 
as the LTFS. Coupling this with the yield strength allowable 
stress level, which is usually about 66 percent of the failing 
strength allowable stress, the yield strength requirement would 
place a much more severe strength requirement on the structure 
if the same reliability as that for the failing strength is 
required. As a result, lower levels of reliability or higher 
"probability of yield" than the probability of failure should be 
considered. After all, yield is only an economic trade-off 
and therefore can accommodate such a consideration . 

3 . 3 Strength Scatter 

Although the methods of estimating the strength scatter of 
the structure are discussed in detail in Volume II, Section 3, 
the limitations on what should be included in the strength 
scatter estimated from test results are not discussed. That 
is, what is sufficient to define the strength scatter of the 
structure is not discussed. The strength scatter has been de- 
fined as the variation in failing loads that occur in a group 
of nominally identical structures that are subjected to the same 
test conditions. In order to remove the subjective nature in 
the definition of nominally identical structures and the definition 
of same test conditions, the following guidelines are presented. 
First the data and factors that should not be considered in defining 
a strength scatter are: 

1) Failing loads of structures clearly in violation 
of the specifications for fabrication. An example 
would be the failure to weld a specified joint, 
with failure resulting. 

2) Failing loads of structures in which wrong material 
has been substituted. 

3) The combinations of first, second, etc., generations 
of a given structure where the generations are de- 
fined by redesign as a result of some failures or 
testing. 
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4) The consideration of only a single-producer varia- 
tion in strength as opposed to the industry-wide - 
variation . 

Second, the factors that should be considered in establishing 
the strength scatter are: 

1) The failure mode - all of the test structures or data 
points must be the result of the same type of failure. 

2) The environment - when the atmosphere is contributing 
to failure (temperature, corrosion) its impact on the 
data used must be considered. 

3) Failing loads of structures with errors that are not 
clearly in violation of a written specification. 

4) The test structures or data is for a single "generation" 
of the structure considered or a similar structure. 

5) The industry-wide variation of the strength of the 
structure, when possible. 

The first two factors not to be considered are representa- 
tive of the blunders that can occur in initial fabrication or 
in the service maintenance of the structure. Care should be 
taken that the failure is attributed to one or the other of the 
fabrication or maintenance before it is excluded from the 
strength scatter data. Otherwise it could fall under the 
jurisdiction of the third factor of those to be considered. 

The third factor not to be considered and the fourth factor 
to be considered are opposites. The point behind this consi- 
deration is the fact that a redesigned structure is a "new" 
structure. The "new" structure is based on the design and 
failure of the original ("old") structure and therefore more 
is known about the "new" one. Essentially, the inclusion of 
both the old and "new" structures in the same strength data 
would deny that any improvement had occurred, thus producing 
a higher y s than actually exists. The last factor to be con- 
sidered is the industry-wide variation in strength as opposed 
to the single producer. In the case of basic materials and 
simple structural elements this consideration can be made. 

However, when the more complex structural elements such as 
special forgings and castings, or structural components such 
as wing boxes are considered, the nominally identical struc- 
tures may be only those of a single producer. 

t 

When insufficient data exists to accurately describe the 
strength scatter of the structural component (as is presently 
the case) , then an estimation method should be used to determine 
a strength scatter. Caution must be exercised when the estima- 
tion results in a very low strength scatter (0 . 01>Yg>0 . 03) be- 
cause the design factors associated with this range of strength 
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scatter allow little room for error. Therefore, there should be 
a requirement that the estimated strength scatter be justified. 
The justification of the strength scatter should be in the form 
of sufficient tests made prior to the use of the component in 
service. When the estimation results in higher strength scatter 
values, the need for justification is less since the design fac- 
tor will approximate that of the Present System which has proven 
adequate in the past. 
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4. 


CONCLUSIONS 


The QSDC Procedure was developed to provide improved 
methods for designing and utilizing structural systems in the 
space shuttle. The QSDC Procedure solves the "new design" prob- 
lem by providing methods to estimate both the strength scatter 
and the loading spectrum of new structural configurations. This 
study, therefore, emphasized the prediction, or the estimation, 
of the strength scatter and the Limit and Omega design levels. 
Section 3 of Volume II presents techniques to estimate these 
three variables. The use of the variable values is detailed 
in Reference 1 and repeated briefly in Section 2, Volume II. 

After defining the failure of a redundant structure, this 
study demonstrated how the structural margins of safety, tests, 
periodic inspections, fatigue measurement techniques, and replace 
ment and/or refurbishment procedures could be successfully re- 
lated to system fail-safe requirements and to the QSDC parameters 
that aid in describing their effect on the probability of failure 
These relationships are discussed in Section 2.5 of this volume. 
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5. 


RECOMMENDATIONS 


Based on the experience gained during the present contract, 
the following recommendations are made with respect to the future 
development of the QSDC Procedure, the incorporation of relia- 
bility procedures in the space shuttle design, and the further in- 
vestigation of the strength scatter coefficient of materials. 

5.1 Follow-On Plan 


Before specific steps for an immediate course of follow-on 
action can be recommended, a general statement of the intended 
overall plan for the development of the OSDC Procedure should 
be stated: The overall plan for the development of the OSDC 

Procedure is to establish it as a useful structural design cri- 
teria method that can be utilized as an acceptable option to 
the present structural design criteria methods. Thus, the pur- 
pose of the recommended follow-on plan will be to achieve this 
goal, and the specific steps will outline the course of action 
necessary to achieve this goal. Specific steps will be necessary 
in essentially two areas: the first of which this section will 
discuss and the second, the demonstration of the QSDC Procedure 
relative to a specific structure, will be discussed in the next 
section. The first area in which the QSDC Procedure requires 
further study is in the specific criteria fields of: 

1) a yield strengh requirement 

2) ' the definition of critical flight situations 

3) the determination of stability factors 

4) the determination of dynamic factors 

Study is necessary to establish the utility of the QSDC Procedure 
in these areas since they have not been previously investigated. 
Essentially the scope of the QSDC Procedure as a design criteria 
methodology must be defined. Once this scope is defined, its 
application can be pursued. 

As the breakdown of how the study should be conducted in 
each subject area is similar, the study on the yield strength 
requirement is explained as an example. The study can be divided 
into a five-task effort, as follows: 

Task Description 

1) Review the State of the Art of Yield Strength Criteria. 

2) Survey of Yield Strength Data to Establish Strength 
Scatter Values. 

3) Development of Reliability of Present Yield Strength 
Criteria . 

4) Development of Yield Strength Design Factors and 
their Relationship to Reliability. 

5) Specification of Guidelines for Using Statistical 
Yield Strength Criteria. 
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Under Task 1 the Air Force, Navy, and industry will be inter- 
viewed on the current practice in yield strength criteria, in- 
terpretation, implementation, and verification. From this review, 
a proper characterization of present practice can be made, and 
the areas where the QSDC Procedure can benefit the design process 
can be defined. 

Task 2 would, essentially, be comparable to the strength 
scatter investigation carried out for ultimate strength. Data 
on all levels of structural configurations will be gathered and 
analyzed for the strength scatter coefficient at yield. 

Task 3 would utilize the strength scatter for yield infor- 
mation in a program to determine the ''yield reliability" of the 
current airframe systems. 

Assuming that the relation of criteria to reliability is 
best characterized by yield strength design factors, Task 4 will 
develop the relationship of design factors to reliability and 
put it in a criteria format. 

Task 5 calls for proper documentation of the statistically 
based yield strength criteria with guidelines for its proper use. 

In summary, the above describes what should be investigated 
to further develop the QSDC Procedure and how it should be in- 
vestigated as a follow-on to the current contract. 

5 . 2 Application to Design of Phase C Structural Component 

The second major area in which the development of the QSDC 
Procedure should be made is in the demonstration of its prac- 
ticality. It is recommended that the QSDC Procedure be imple- 
mented in a parallel study with the Present System in the design 
of the Phase C space shuttle structural component. Such a study 
is recommended so that the benefits of the QSDC Procedure can 
be properly illustrated. The actual benefits of the use of the 
QSDC Procedure cannot often be realized in a general type study 
such as that in the present contract, but are clearly defined 
in a structural application. 

5 . 3 Strength Scatter Investigation 

The strength scatter data of Section 2.4, Volume II, repre- 
sents what was available and could be included in the amount of 
time the program allowed. The data presented is only the begin- 
ning of the data that could be obtained by a more extensive 
program in this area. Such a program might include an effort 
to include the strength scatter coefficient on the MIL-HDBK-5A 
Coordinating Committee Agenda. If the strength scatter were 
considered by this committee as an important material parameter, 
it might eventually be included in the handbook. As previously 
noted, there is a good deal of data available from this committee. 
The inclusion of this data could greatly assist in the development 
of the QSDC Procedure. 
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